Unit 42 says Falcon C2 compromised government sites via browser JavaScript
The framework stole credentials and cookies, sideloaded Chrome extensions, and delivered the Antino implant over OneDrive.
Stories per day · 30 days
4 RSS
Relatedandroid2aws2malware2accessibility1adb1ahsaycbs1backup1bash-stager1bedrock1botnet1browser1camera-management1clickfix1cms1dll-side-loading1dll-sideloading1fake-recruiter1falcon1
72 stories, newest first · one card per story
Stories tagged #c2
AhsayCBS intrusion left webshells, an XMRig miner, and a C2 implant
Huntress analyzed three servers breached October 8-11, 2026, before Ahsay's hotfixes, and found a host-locked in-memory implant.
Varonis Discovers NotC2 AI-Powered C2 Framework
NotC2 uses AWS Bedrock to interpret natural language commands and routes them via SQS, Lambda, and SNS.
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google dismantles XCPE botnet of 1.3 million devices and bans Videostrong Technology Co for intentional malware installation.
Compromised camera software used to deploy malware, Huntress says
In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.
1
Siemens Software Center DLL flaw exploited in ClickFix attacks
CVE-2026-110936, fixed in 4.0.9.8, was used to side-load malware beside an unmodified signed executable in the Romulus campaign.
3
Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
Android RAT YuanKong leaks operator account IDs while abusing Accessibility and Wireless Debugging to control phones.
FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Fake-recruiter trojan distributed via taikotalent.xyz has been taken down after the registrar placed the domain on clientHold on October 10.
2
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer now bypasses Chromium app-bound encryption, runs remote commands, and exfiltrates data over encrypted TCP.
3
VirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
VirusTotal now scans public IPv4 daily, recording ports, banners, and fingerprints to surface C2 infrastructure.
4
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
4
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 says DPRK-linked actors use Web3 smart contracts as C2 for npm worms stealing cloud credentials.
5
Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices
Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.
7
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
Cling botnet malware disguises its commands as Google STUN traffic on compromised IoT devices.
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
Cling, a new IoT botnet, hides command-and-control in spoofed Google STUN traffic while exploiting Realtek CVE-2021-35394.
Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365
Antino Windows backdoor routes its entire command-and-control through Microsoft 365, using themed HTA/WSF stagers against Taiwan, Tibet, and Latin America targets.
1
CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer
Jamf found CloudSyncD, a macOS backdoor in a fake Zoom installer that captures a password to launch its payload.
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
Cisco Talos attributes UAT-11587 (China-nexus) to compromising ~350 endpoints in eight Asian countries using the Antino backdoor with Microsoft Graph-based C2.
RemoteThreat Launches With $7 Million for Offensive Operations Platform
RemoteThreat launched with $7 million pre-seed for an offensive operations platform combining C2, implants, initial access, and governed AI workflows.
1
Hackers Turned Ethereum Into a Secret Messaging System for Malware
North Korea-linked XCTDH malware encodes C2 server addresses into Ethereum recipient addresses, giving its RAT and credential stealer resilient command channels.
Researchers Found a Windows RAT That Turns Victims’ Screens Into Live Streams
Point Wild detailed BotHelper, a Windows RAT that live-streams victim screens and tampers with AMSI.
5
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry
Ongoing Russia-linked Operation Talked is spying on Ukraine’s defense industry after an exposed C2.
1
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
SANS analysis shows Macfinger ClickFix delivers a macOS infostealer distinct from AMOS Stealer, using fake CAPTCHAs, websocket C2, and Keychain password theft.
2